Legal notice and privacy

The text, visuals, mockups, logos and code of this site belong to KB Digital Services LLC unless stated otherwise. Third-party technology names and logos (React, Next.js, Swift, etc.) belong to their owners and are mentioned for descriptive purposes only. Any reproduction without written permission is prohibited.

The controller of the personal data collected on this site and by its phone assistant is KB Digital Services LLC, reachable at contact@kevin-boileux.com. Kévin Boileux, who runs the company, works remotely: the data may therefore be accessed from Thailand.

This site sells no data, shows no advertising and does no profiling.

Contact form:

• data: name, email address, message, and, if you provide them, phone number and subject;
• purpose: replying to your request and, where relevant, preparing a quote;
• legal basis: steps taken at your request before entering into a contract (GDPR article 6(1)(b));
• retention: the message is sent by email and is not stored in any database; it is kept in the inbox for 3 years after the last exchange, then deleted.

Free SEO audit:

• data: the address of the page analyzed and your IP address; the IP is used to limit the number of audits per day and, together with the date, the page and the score obtained, to keep a log of audits that the publisher reviews to prevent abuse and follow how the tool is used (legal basis: legitimate interest); this log is erased after 30 days;
• the report stays in memory for 2 hours, then is erased; it is kept for 30 days if you create a share link or ask for it by email;
• if you ask for the report by email, your email address is used for that message and is not kept; if you also agree to be contacted, it is forwarded to me with the report link (legal basis: your consent, which you can withdraw at any time) and kept for 3 years after the last exchange;
• to complete the report, the address of the site analyzed (never yours) is submitted to public services: Google (Chrome UX Report, Web Risk), the Internet Archive (web.archive.org), domain name registries and an SEO data provider.

Business prospecting:

• if I wrote to you to offer my services, here is what I keep: your business name, activity, city, phone number and website as shown on its Google listing, a business email address, the issues found on your website, my messages and your replies;
• the email address comes from your website, your listing, your business's Facebook or Instagram page (recognised by its phone number, or by its name and town), another public page where it appears next to your business name or phone number, or a business email directory; each message says where I found it;
• before the first message, a verification service checks that the mailbox exists, without sending anything to it; an address that does not exist is discarded and never used again;
• if you call the phone assistant, the date and outcome of the call are added to this data: I stop following up, and an objection stated to the assistant counts as unsubscribing;
• legal basis: legitimate interest (business-to-business prospecting related to your activity);
• if the message contained a link to your website's audit report, the number of times the report is viewed is counted, with no other data;
• you can object at any time: reply "stop" or use the unsubscribe link; your address and domain are then added to an exclusion list, kept so that you are never contacted again;
• retention: 1 year for a business never contacted, otherwise 3 years after the last exchange.

Client area, quotes and invoices:

• data: name, email, company, address, company or VAT number where relevant, quotes, invoices and payments, tracked SEO projects;
• purpose: performing the services ordered, invoicing, giving you access to your documents;
• legal basis: the contract (GDPR article 6(1)(b)) and accounting obligations (article 6(1)(c));
• retention: the account is kept for the duration of the business relationship, then 3 years; invoices and accounting records for 10 years (French Commercial Code, article L123-22);

Analytics and logs:

• anonymous analytics (Umami, installed on a server of the publisher, cookie-free) count page views and a few clicks; they keep neither IP addresses nor identifiers;
• the server keeps technical logs (IP address, page requested, date) for security; they are erased by automatic rotation after a few days.

Data is shared only with the providers the site needs to run:

• Hetzner Online GmbH (Germany): hosting of the site and its database;
• OVH SAS (France): the contact@kevin-boileux.com mailbox;
• Google LLC (United States): reCAPTCHA, which protects the contact form and the SEO audit against bots;
• for business prospecting: a data provider (company established in Estonia) that supplies businesses' Google listings and the search results used to find their email address; a business email directory (American company), queried with the domain name of the business's website; two services that read the contact details published on businesses' Facebook and Instagram pages (American companies); an email address verification service (company established in Hungary); and the technical intermediary that passes these requests on to them without keeping their content; their names are given on request;
• for the phone assistant, the providers listed in its section below.

The publisher is an American company and its manager works from Thailand: data is therefore transferred outside the European Union, to the United States and Thailand. Not all of these countries benefit from an adequacy decision of the European Commission. Google participates in the EU-U.S. Data Privacy Framework. For the other transfers, the publisher limits data to what is necessary and protects it (encrypted access, personal accounts).

At 02 59 66 01 03 (+33 2 59 66 01 03), an artificial intelligence answers for Kévin Boileux, 24/7, in French. It says so at the start of the call. It answers questions about his services and, if you wish, takes down your details or a callback request for Kévin. It never places calls and makes no decision on your behalf.

Data processed:

• the number shown, the date and length of the call;
• what you say, transcribed into text during the call; the conversation is not recorded as audio;
• what you choose to give: email address, name, company, city, need, and for a callback the channel, number and time;
• if the assistant cannot answer, the message you leave on the voicemail: it is recorded, transcribed and emailed to Kévin;
• technical measurements: line quality, response times.

Purposes and legal bases:

• answering your questions and passing your request on to Kévin: steps taken at your request before entering into a contract (GDPR article 6(1)(b));
• keeping the transcript to follow up on your request and improve the assistant, measuring call quality and preventing abuse (beyond four calls an hour from the same number, the voicemail answers; withheld numbers and automated callers are rejected): the publisher's legitimate interest (article 6(1)(f)).

To refuse the transcription, say so, at the start of the call or at any time. The assistant confirms and hangs up, and nothing you said is kept. Only the number, date and length of the call are (90 days), and Kévin is told you called. What you said before was processed in real time by the providers below, under their own terms.

Providers:

• OVH SAS (France): the assistant's server and the email service;
• the website host (Germany): an encrypted copy of the assistant's backups, which it cannot read;
• the number's phone carrier, which routes the call (European Union);
• a speech recognition service, which transcribes your voice (American company, servers in the European Union); if it does not respond, a second service of the same kind takes over (American company, servers in the European Union);
• an artificial intelligence service, which writes the answers from the transcript (American company, servers in the European Union); if it is slow or down, the same request goes through a second service, in the United States, which does not keep it and may have it processed outside the Union;
• a speech synthesis service, which gives the assistant its voice (United States): it receives the text of the answers, which may contain your email address read back, your name or a callback number;
• an email verification service, which checks that your mailbox exists without sending it any message (American company, servers in the European Union);
• a search engine (American company): if you dictate an address on a business domain name, that name alone (never the part before the @) may be searched during the read-back to correct its spelling;
• my prospecting list: if I wrote to you, the assistant finds you in it by your number, by the website or the business name and town you mention, or by the email address you give; it reads there the business name, its website, the points noted on that website and the address I wrote to, so it can go over my message again without making you spell your address; your call stops my follow-ups, or unsubscribes you if you ask;
• the French government's public business directory: after the call, your business name and town are looked up there for my records (SIREN, activity).

If you called, Kévin will give you the name of each of these providers on request at contact@kevin-boileux.com.

Retention:

• transcript and caller number: 90 days, then erased; only data that no longer identifies you remains (date, length, outcome, response times);
• voicemail message: the recording 30 days, its transcript 90 days;
• details taken down for Kévin: 3 years after your last call;
• emails received by Kévin (your details and need, or your message, never the conversation): 3 years after the last exchange, like contact form messages;
• database backups and their encrypted copy: 15 days; telephony technical logs: 5 weeks at most.

Your rights are exercised as described below, giving the number concerned: Kévin can export or erase everything related to it.

You can request access to your data, its correction, erasure, restriction of processing or portability, object to processing and withdraw any consent at any time. You can also set instructions for what happens to your data after your death.

Write to contact@kevin-boileux.com: you will get an answer within one month. If it does not satisfy you, you can lodge a complaint with the CNIL (the French data protection authority) or with the data protection authority of your country.

The public site sets no analytics or advertising cookies.

• client area: a session cookie, required to sign in, valid for 7 days;
• contact page and SEO audit: Google reCAPTCHA may set a cookie and analyzes technical data (IP address, browser, behavior on the page) to tell humans from bots, under Google's privacy policy;
• your language and theme preferences are kept in your browser (local storage) and never sent to the server.

The contact page no longer shows a Google Maps map, so it no longer sets the related cookies.

Lexo translates on the Mac, with Apple's engine: no text is sent to the publisher or to any third party. Beam encrypts its sessions end to end: the publisher's relay, hosted by Hetzner in Germany, cannot read the video, audio or input. To connect two Macs, it processes their Beam IDs, their names and their IP addresses, and keeps a technical log of the IDs for about two weeks.

For updates, each app reads a version file published on GitHub once a day; GitHub sees the IP address and the app version, as with any download. For an Internet session, Beam also asks Google's and Cloudflare's STUN servers, which see the Mac's public IP address. The details are in each app's privacy policy: Beam and Lexo.

Services (small business websites, redesigns, maintenance, development) are governed by the terms of sale.